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Abstract — We derive a lower bound on the secrecy capacity of 
the compound wiretap channel with channel state information 
at the transmitter which matches the general upper bound on 
the secrecy capacity of general compound wiretap channels given 
by Liang et al. and thus establishing a full coding theorem in 
this case. We achieve this with a stronger secrecy criterion and 
with a decoder that is robust against the effect of randomisation 
in the encoding. This relieves us from the need of decoding the 
randomisation parameter which is in general not possible within 
this model. Moreover we prove a lower bound on the secrecy 
capacity of the compound wiretap channel without channel state 
information and derive a multi-letter expression for the capacity 
in this communication scenario. 

I. Introduction 

Compound wiretap channels are among the simplest non- 
trivial models incorporating the requirement of security against 
a potential eavesdropper while at the same time the legitimate 
users suffer from channel uncertainty. They may be considered 
therefore as a starting point for theoretical investigation tend- 
ing towards applications, for example, in wireless systems, a 
fact explaining an alive research activity in this area in recent 
years (cf. |fl~), Q and references therein). 
In this paper we consider finite families of pairs of channels 
2B = {(W t , V t ) : t = 1, . . . , T} with common input alphabet 
and possibly different output alphabets. The legitimate users 
control Wt and the eavesdropper observes the output of Vt. 
We will be dealing with two communication scenarios. In the 
first one only the transmitter is informed about the index t 
(channel state information (CSI) at the transmitter) while in 
the second the legitimate users have no information about that 
index at all (no CSI). This setup is a generalisation of Wyner's 
||3l wiretap channel. 

Along the way we will comment what our results look like 
when applied to widely used class of models of the form 
W = {(W t ,V s ) :t=l,...,T,s=l,...,S} with T ? S 
which are special cases of the model we are dealing with in 
this paper. 

Our contributions are summarised as follows: In [1 1 a general 
upper bound on the capacity of compound wiretap channel 
as the minimum secrecy capacity of the involved wiretap 
channels was given. We prove in Section ITlI-B I that the models 
whose secrecy capacity matches this upper bound contain all 
compound wiretap channels with CSI at the transmitter. At the 
same time we achieve this bound with a substantially stronger 
security criterion employed already in O, 0, 0, and 0. 
Indeed, our security proof follows closely that developed in Q 
for single wiretap channel with classical input and quantum 



output. In order to achieve secrecy we follow the common 
approach according to which randomised encoding is a permis- 
sible operation. The impact of randomisation at the legitimate 
decoder's site is usually compensated by communicating to 
her/him the outcome of the random experiment performed. 
However, in the case of compound wiretap channel with CSI 
at the transmitter this strategy does not work as is illustrated 
by an example in Section HV-AI We resolve this difficulty by 
developing a decoding strategy which is independent of the 
particular channel realisation and is insensitive to randomisa- 
tion while decoding just at the optimal secrecy rate for all 
channels {Wt ■ t = 1, . . . , T} simultaneously. 
Moreover, a slight modification of our proofs allows us to 
determine the capacity of the compound wiretap channel 
without CSI by a (non-computable) multi-letter expression. 
This is content of Section ITlI-CI We should mention, however, 
that the traditional proof strategy of sending the pair consisting 
of message and randomisation parameter to the legitimate 
receiver works as well in the case where the transmitter has 
no CSI. 

In Section IIV-BI we give an example of compound wiretap 
channel such that both the set of channels to the legitimate 
receiver and to the eavesdropper are convex but whose secrecy 
capacities with CSI and without CSI at the transmitter are 
different. Indeed the former is positive while the latter is equal 
to 0. 

Section IIII-DI is devoted to the practically important model 
2B = {(Wt,V a ) : t = 1,...,T,8 = 1,...,S} with the 
assumption that the transmitter has CSI for the T-part but has 
no CSI for the 5-part of the channel. Here again we provide a 
multi-letter expression for the capacity. Additionally, we give 
a computable description of the secrecy capacity in the case 
where the channels to the eavesdropper are degraded versions 
of those to the legitimate receiver. 

Our results are easily extended to arbitrary sets (even un- 
countable) of wiretap channels via standard approximation 
techniques |8|. 

II. Compound wiretap channel 
A. Definitions 

Let A,B,C be finite sets and 6 = {1, ...,T} an index 
set. We consider two families of channels Wt ■ A — >• ^(-BjH 
Vt : A —> V(C), t e 6, which we collectively abbreviate by 
2U and call the compound wiretap channel generated by the 
given families of channels. Here the first family represents the 
communication link to the legitimate receiver while the output 



'■p(-B) denotes the set of probability distributions on B. 
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of the latter is under control of the eavesdropper. In the rest 
of the paper expressions like W® n or V® n stand for the n-th 
memoryless extension of the stochastic matrices Wt, Vt- 
An (n, J n ) code for the compound wiretap channel 2U consists 
of a stochastic encoder E : J n —> "P(A n ) (a stochastic matrix) 
with a message set J n := {1,..., J„} and a collection of 
mutually disjoint decoding sets {Dj C B n : j £ J n }- The 
maximum error probability of a (n, J n ) code C n is given by 



e(C„) := max max > 
v " ; tee jej n ^ 



E^li)^"^^"). (i) 



I.e. neither the sender nor the receiver have CSI. 
If channel state information is available at the transmitter 
the notion of (n,J n ) code is modified in that the encoding 
may depend on the channel index while the decoding sets 
remain universal, i.e. independent of the channel index t. The 
probability of error in ([TJ changes to 



ecsi(C„) 



max max 

tee jej n 



E 



E t (x n \j)W® n (D]\x n ). 



We assume throughout the paper that the eavesdropper always 
knows which channel is in use. 

Definition 2.1: A non-negative number R is an achievable 
secrecy rate for the compound wiretap channel 2U with or 
without CSI respectively if there is a sequence (C n ) n en of 
(n, J„) codes such that 

lim e(C„) = resp. lim e CSI (C„) = 0, 



and 



lim inf — log J n > R, 

n— >oo fi 



lim max/(J;Z") = 0, 



(2) 



where J is a uniformly distributed random variable taking 
values in J n and Z™ are the resulting random variables at the 
output of eavesdropper's channel V® n . 
The secrecy capacity in either scenario is given by the 
largest achievable secrecy rate and is denoted by C5 (2U) and 

B. Hints on operational meaning of strong secrecy 

A weaker and widely used security criterion is obtained if 
we replace © by lirun^oo max t6 g ^I(J', %t) = 0- We prefer 
to follow (4), (6), and Q and require the validity of (0. A 
nice discussion on interrelation of several secrecy criteria is 
contained in |0. We confine ourselves to giving some hints 
on the operational meaning of the requirement (0. To this 
end we restrict our attention to the case where the transmitter 
has no CSI in order to simplify our notation. The case of 
compound wiretap channel with CSI at the transmitter can be 
treated accordingly. Set 

e„ := max J(J; ZV") with lim e n = 0. 

tee n— >oo 

Then Pinsker's inequality implies that 



with a positive universal constant c, where || ■ || is the 
variational distance. Suppose that the eavesdropper chooses 
for each t £ 9 decoding sets {Kj t C C n : j £ Jn} with 
C" = [Jj e j Kj :t - We will lower bound the average error 
probability (and consequently the maximum error probability) 
for every choice of the decoding rule the eavesdropper might 
make. Set 

4l E E(x n \j)V® n (Kl t \x n ). 

Jn 



jej„ x n eA" 



Then 



e av (t) 



jeJn 

PJZ? I (J x K h 
\jejn 



> pj® Pz ? |J {j} x Kl t 
\jej n 

= pj® pz? {{j} x K r jt ) - Cy/en~ 

>ej„ 



jEJn 
1 

Jn jej n 

Jn-1 



CWEn 



1 J Cy/Fr, 



(4) 



\PJZ? 



PJ ® PZ? I I < Cy 



Vt £ 0, 



(3) 



where in the second and the fourth line we have used the fact 
that the sets {j} x Kj t , j £ J n , are mutually disjoint, the 
third line follows from (0, and in the sixth line we merely 
observed that for any non-negative numbers 01, ... ,a,j with 
2~2j= 1 a j = 1 we have 2~2j=iQ — aj) = J — 1. Consequently, 
the average (and hence maximum) error probability of every 
decoding strategy the eavesdropper might select tends to 1 
as soon as J„ — > 00. It should be remarked, however, that 
although for the vast majority of messages the eavesdropper 
will be in error there is still a possibility left that she/he can 
decode a small fraction of them correctly. 
As will follow from the proofs below we will have e n = 2~ na , 
a > 0, and J n = 2 nR , R > 0, if the secrecy capacity 
is positive so that the speed of convergence in <j4j will be 
exponential. 

Notice that Q means that the random variables Z™ at the 
output of the channel to the eavesdropper are almost inde- 
pendent of the random variable J embodying the messages 
to be transmitted to the legitimate receiver. Therefore it is 
heuristically convincing that our criterion (0 offers secrecy 
to some extent for communication tasks going beyond the 
transmission of messages. To demonstrate this by an example 
we introduce, based on [9], the notion of identification attack 
as follows. Suppose that for each fixed t £ 8 and any j £ J n 
there is a subset Kj t C C n on the eavesdropper's output 
alphabet where now the sets Kj t need not necessarily be 
mutually disjoint. With E : J n — > ViA 71 ) being the stochastic 
encoder used to transmit (!) messages to the legitimate receiver 
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we can write down the identification errors of first and second 
kind (cf. [9 1 for further explanation of this code concept) for 
the eavesdropper's channel as 



J2 E(x n \j)V® n (Kl t \ 



and 



E{x n wr{K 3 Ax n ) 



(5) 



(6) 



x n eA r > 



for j, i G J n , j. 

One possible interpretation of this attack, again based on (9), is 
that on the eavesdropper's side of the channel there are persons 
F% , . . . , Fj n observing the output of the channel. The sole 
interest of Fj is whether or not the message j has been sent 
to the legitimate receiver. Thus Fj performs the hypothesis 
test represented by Kj t t based on his/her knowledge of t G 9 
and ©, © are just the errors of the first resp. second kind 
for that hypothesis test. 
Let us define for j G J n 



g(j,t):= (E(x n \j)V® n (Kl t \x n ) 

+ j^j2E(x n \i)V* n (K j , t \x n j), 



i=i 



which is a number in [0, 2]. 
Notice that if 

g(j,t) > 1 - V 
for some 77 G (0, 1) then either 



J2 E{x n \j)V® n {Kl t \x n ) > 



i"6A" 

or there is at least one i ^ j with 



]T E(x n \i)V® n (K j>t \x n )> 



1 — 77 



1-7? 



i»eA" 



or both, so that no reliable identification of message j can be 
guaranteed. We show now that under assumption of (O we 
have 

x Jn 

> 1-^, Vn=o(n°) (7) 

'Jn 



so that at most a fraction |(1 + T] n ) of j G J n can satisfy the 
inequality 

This last assertion is readily seen from (0 by applying 
Markov's inequality to the set 



F:={j G Jn :2-g(J,t) > -}. 



In order to prove (0, note that for any t G 6 

Jn 3=1 

= E (pjz?({j} x K h) + j^jpjz T ({j} c x kJ 

1 Jn 

= pjz?( IJ W x K W + y— tEp^HOT x K jtt ) 

>Pj®Pz?{ (J {j}xif? t )+ 

1 J " _ Jn — 

+ T-. 2_,PJ®Pz?({j} c x K jtt ) - cy/eTt - c " y/e^ 

>J n -t . , <Jn L 

3=1 

1 ^ n 2 7—1 



1 - cy^ 



2J„-1 

Jn - 1 ' 



where in the third line we have used (01 and in the fourth we 
inserted pj{{j} c ) = 

Besides the attempts of the eavesdropper to decode or identify 
messages we can introduce attacks corresponding to each 
communication task introduced in iflOl . It would be interesting, 
not only from the mathematical point of view, to see against 
which of them and to what extent secrecy can be guaranteed 
by the condition (0. 

III. Capacity results 

A. Preliminaries 

In what follows we use the notation as well as some 
properties of typical and conditionally typical sequences from 
ifTTl . For p G V{A), W : V{B), x n G A n , and S > we 
denote by T™ s the set of typical sequences and by T^ s (x n ) 
the set of conditionally typical sequences given x n in the sense 

of 031. 

The basic properties of these sets that are needed in the sequel 
are summarised in the following three lemmata. 

Lemma 3.1: Fixing 5 > 0, for every p G V{A) and W : 
A -> V(B) we have 

p® n {r;] s ) > 1 - (n + i)\ A h- ncS2 

W® n (T% iS (x n )\x n ) > 1 - (77 + l)\A\\B\ 2 -nc8 2 

for all x n G A n with c = 1/(2 In 2). In particular, there is 
77 G N such that for each 5 > and p G V{A), W : A -> 
V{B) 



W®"(7^, a (a;™)|x") > 1 - 2- nc ' s2 

holds with c' = |. 

Proof: Standard Bernstein-Sanov trick using the proper- 
ties of types from [11 1 and Pinsker's inequality. The details 
can be found in lfl2l and references therein for example. ■ 



4 



Recall that for p G V(A) and W : A -> V(B), pW G V(B) 
denotes the output distribution generated by p and W and that 

x n G T p n 5 and y n g 7^(z") imply that y n g T p V 2|A|5 . 
Lemma 3.2: Let x n g 7^, then for V : A -> "P(C) 



1^ 



y™(z"|a: n ) < /3 for all z"€^(i") 
hold where 

Q = 2 -»(if( J >y)+/ 1 (<5)) (8) 

P = 2- n(H( - vlp} ~ h{5)) (9) 

with universal fi(S), fz(S) > satisfying Mmg^aa fi(S) = 
= lim^oo f 2 (5). 

Proof: Cf. CD. ■ 
In addition we need a further lemma which will be used 
to determine the rates at which reliable transmission to the 
legitimate receiver is possible. 

Lemma 3.3: Let p,p g "P(v4) and two stochastic matrices 
W, W : A -> be given. Further let 7? (5) be the 

output distributions, the former generated by p and W and the 
latter by p and W. Fix (5 g (0, 407751 )■ Then for every neN 

for all x n £ 7^ n 5 and 

for all x n g holds for a universal /(<5) > and 

lim^o f(S) = 0. ' 

Proof: Cf. d. ■ 
The last lemma is a standard result from large deviation theory. 

Lemma 3.4: (Chernoff bounds) Let Z\,...,Zl be i.i.d. 
random variables with values in [0, 1] and expectation EZj = 
H, and < e < |. Then it follows that 

Pr |z^ Zi; ^ [(1±eM } - 2cxp ' 

where [(1 ± e)/i] denotes the interval [(1 — e)/i, (1 + e)/x]. 

B. C57 a? me transmitter 

The main result in this section is the following theorem. 
Theorem 3.5: The secrecy capacity of the compound wire- 
tap channel 2B with CSI at the transmitter is given by 

C s ,csi (2U) = min max (I(V,Y t ) - I(V,Z t )). 
tee v^x^(YZ)t 

Notice first that the inequality 

Cs,csi{W) < min max (J(V, F t ) - J(V, Z t )) 
tee y^x^(yz), 

is trivially true since we cannot exceed the secrecy capacity 
of the worst wiretap channel in the family 2U. This has been 
already pointed out in fl]. The rest of this section is devoted 
to the proof of the achievability. 



Proof: We choose pi,...,px £ ~P(A) and define new 
probability distributions on A n by 



if x» g 7£„ 
otherwise, 



(10) 



Define then for z 11 G C", x n g A' 



Qt, e -(« n ) = ^(* n |a; n )-l7- i ,(»»)(« n ) 



on C™. Additionally, we set for z n G C n 



E 



(ID 



x"£T 



Pt> s 



Now let S := {z n g C n : 6£(> n ) > ea t } where e = 2-" c '' 52 
(cf. Lemma [3TTb and at is from ^ in Lemma [3T21 computed 
with respect to pt and Vt- By lemma 3.2 the support of <d' t 
has cardinality < a^ 1 since for each x n g 7^ 5 it holds that 

l% tS (x n ) C 7;> t 2 . A . S , which implies that E^s *( z ") > 
1 - 2e, if 



Q t (z n ) = e;(z")-l 5 (z n ) and 



(12) 

(*) 



Now for each t £ 6 define J n -L nt i.i.d. random variables X-, 
with j g [J n ] := {1, . . . , J n ] and J g [L n ,t] ■= {1. • • • > 
each of them distributed according to with 



Jn 
L n ,t 



2n[m\n tee (I(p t ,W t )-I(p t y t ))-T] 

2 n[/(pt,V t )+f] I 



(13) 
(14) 



for r > 0. Moreover we suppose that the random matrices 

{ X j*l}MJ n ],le[L n ,i] and } }je [./„], ie[L nJ ] are independent 
for t ^ t'. Now it is obvious from dlTT > and the definition of 
the set S that for any z n G 5 9 t (z") = EQ „(*)(>") > ea t 
if E is the expectation value with respect to the distribution 
p' t . For the random variables /3 t _1( 9 t x {t) define the event 



't.X 



(t) (z")G [(l±e)e t (z n )] 



(15) 

and keeping in mind that Q t (z n ) > eat for all z n £ S it 
follows that for all j G [J n ] and for all t G 6* 

Pr{(ii(t)) c } < 2|C| n exp(-L„, t ) (16) 

by Lemma [3~4~1 Lemma [3721 and our choice e = 2~" c s with 
: = /i((5) + / 2 (5)+3c , ( 5 2 . Making 5 > sufficiently small 
we have for all sufficiently large n G N 

£ ( 2- n [ / (Pt. V t)+9(' 5 )] > 2™¥. 

Thus, for this choice of i5 the RHS of ( fTSI l is double expo- 
nential in n uniformly in t G 6* and can be made smaller than 
eJn 1 f° r all j G [J n ] and all sufficiently large n G N. I.e. 



Pr{M*)) c } < eJ- 1 VtE 



(17) 



Let us turn now to the coding part of the problem. Let p' t G 
V{A n ) be given as in (TO). We abbreviate X := {X(*)} tee for 
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the family of random matrices X^ — {X^ }je[J„],le[L„ t ] 
whose components are i.i.d. according to p' t . We will show 
now how the reliable transmission of the message j £ [J„] 
can be achieved when randomising over the index I £ L n t 
without any attempt to decode the randomisation parameter at 
the legitimate receiver (see section II V- Al l. To this end let us 
define for each j £ [J n ] a random set 

see k£[L„ }S ] 

and the subordinate random decoder {Dj(X)}j e u n ] C B n is 
given by 



D 3 {X) :=D'(X)n 



U D 'A X ) 



l/6W 



(18) 



Consequently we can define the random average probabilities 
of error for a specific channel t £ 9 by 



Jn je[Jn] le[L ntt ] 
Now ([T8l implies for each ted and I £ [L n ,t] 
Wr{{D 3 {X)) c \xf) 

<< n (fl D (Vr., s i x it!)r\ x fl) 

see fce[L„, s ] 

+ E E E wr{T^ 5 {x%)\ X f) 



(19) 



see fce[L„ 



(20) 



< ^r((^(^ ) )) c i4 t) ) 

+ E E E wr(7^ a>5 (xW)|xW), 

/e[Jn] see fee[i„,»] 

where the second inequality follows by the monotonicity of 
the probability. By Lemma 13.11 and the independence of all 
involved random variables we obtain 

r®n(( n .t V\\c\ yWi 



E x (Wr((D 3 (X)r\X^>)) 
< (n + l)l A H s l -2 



-ncS 



E E E 

j'e[J n ] s ^ e ke[L n , ! 



E xM E x(t) wr(7^ 3 , 5 (X^ k )\X^). 

j' k 



(21) 



We shall find now for j' =t j an upper bound on 



E 



X 



= p' t (^)wr(T^^i)\x n ) 
* E 4^wr(T^A xi rl)\- n ) 

qf n (T^ s {X^l)) 

pf n (r P i s ) • 



(22) 



By Lemma [3711 and by Lemma [331 for any £, s £ # we have 

> — ncS 2 

(23) 



pf l (T p ^)>l-(n + l)l A l-2- 



with a universal f(5) > satisfying lim^o f{S) — since 
Xj?l £ 7^" s with probability 1. Thus inserting this into 
we obtain 



E xW wr(T^ s (x(;l)\x^ 



< 



(n + l)l A H J 



. 2 -n(I(p s ,W s )-f(S)) 



1 - (n+l)\ A \ ■ 2-" c52 

for all s,t £ 9, all j' ^ j, and all / £ [I„ !t ],fc e [t„, s ]. 
Now by defining v n (5) := (n + 1)\ A W B \ ■ 2- ,lc52 and n n (5) := 
1 - (n + • 2" nc52 thus for each t £ 9, I £ [L n , t ], and 
j € (ED and (ED lead to 

E x (Wr((DAX)r\X^)) 

(n+l) |A||s| ^ 9 -n(/(p 3 ,W s )-/(i)) 

see 



< ^n(<5) + 

< M 5 ) + 



(n + l)l A Hsi 



(/(p»,W,,)-/(j)„Vi)-/(«)-J) 



< Un(5) 



+ 



fJ-n (<$) 



T ■ J n ■ 2~ 



^(min a€ g(I( P3 ,W B )-I( Ps ,V 3 ))-f(S)-f) 



<v n (6)+ {n+1 ^ m T.2-^-m-B 
(n+ lV- 41151 

fJ. n (0) 

(24) 

where we have used (TBI . ( fT3l >. and we have chosen S > 
small enough to ensure that t — f(S) — J > 5. Defining 

a = a(<5, t) := we can find n(S, r, \B\) £ N 

such that for all n > n(5,r, 

E^(Wf n ((£) J -(Af)) c |xj* ) )) < T ■ 2-' na 

holds for alH £ 9, I £ [L nyt ], and j £ [J n ]. Consequently, for 
any t £ 9 we obtain 

E X (\^(X)) <T-2- na . 

Additionally we define for any t £ 9 an event 

o (t) = {\$(X)<VT2- n %}. (25) 

Then using the Markov inequality applied to A„ (X) along 
with (|25T >. we obtain that 

Pr{(^o(i)) c } < VT2-"t. (26) 

Set 

l := n n ( 2? > 

tee fc=o 

Then with (JTTJ, (|26] >, and applying the union bound we obtain 

Pr{t c } < ^2^2Pi{(i k (t)) c } <T -e + T^ -2- n ^ 
tee k=o 

< T 2 ■ 2~ nc " 



6 



for a suitable positive constant c" > and all sufficiently large 

neN. 

Hence, we have shown that for each t € 9 there exist 
realisations {(xfi )je[J»],J£[£„,t] ■ t ^ 9} £ l of X. Now, 
denoting by || ■ || the variational distance 

\\p-q\\ ■= E M x ) ~ 

for p. q e A, we show that the secrecy level is fulfilled 
uniformly in t G 6 for any particular {(ajj* )je[J n ],lE[L n t] '■ 
I ■ 0} ■ i . 



Li, 



i=i 



-E(Q,^(-)~Q t ,^(-)) 

n,t ' i l ' 3 l 



L E< 



£71, t 



„«(•) -©*(•) 



In the first term the functions V t n (■Ixf) ) and Q <*)(•) differ if 
z n ^ Tp t y t 2\a\8> so ^ ma kes a contribution of e to the bound. 
In the second term Q t and Q t are different for z" ^ S* and 
because tj(t) and X) z «es > 1 — 2e imply that 

— EE^^ 1 - 3 ^ 

/— 1 z n eS 

the second term is bounded by 3e. The third term is bounded 
by e which follows directly from (TT~5T >. 

For any {(a^'^je^ye^ j : t £ 9} £ t with the correspond- 
ing decoding sets {Dj : j £ [J n ]} it follows by construction 
that 

4" E 7^ E ^"(^jl^?) ^ VT-2- na ' (29) 

Jn ,-6[J n ] n,t ie[i„,.] 
is fulfilled for all t € with a' > 0, which means that we have 
found a (n, J n ) code with average error probability tending to 
zero for neN sufficiently large for any channel realisation. 
Now by a standard expurgation scheme we show that this still 
holds for the maximum error probability. We define the set 

Gt '■= {j G J n '■ j— E Wf n {D^)<^n] (30) 

ie[L„, f ] 

with i] := VT ■ 2~ na and denote its complement as B t := G£ 
and the union of all complements as B — {J tG0 Bt- Then 
and (f30b imply that 



< 5e. (28) 



»?>-r E t— E wr(D^)>^,~ 



Jn je[Jn] H L 



for all t € 9 and by the union bound it follows that 

\B\ <El B *l ^ T 'VV- Jn- 



After removing all j G B (which are at most a fraction of 
T42 _n ~2~ of J n ) and relabeling we obtain a new (n, J n ) code 
(Ej, Dj).^,j j without changing the rate. The maximum error 
probability of the new code fulfills for sufficiently large n € N 

max max — V Wf n (D c Ax { ^) < T* ■ 2~ n ^ . 



On the other hand, if we set 

V?(z n \(j,t)) :=V?(z»\x$) 
and further define 



(31) 



V t n Az n ) 



V t n {z n ) 



T^^WKi.')), (32) 

(33) 



1=1 



Jn J = 1 



we obtain that 



tec 



\\v%-V?\\ < \\v^-e t \\ + \\e t -vr\\ 

< 10e, 

for all j € [J n ]ji G $ with e = 2~ nc 5 where we have used 
the convexity of the variational distance and d28| i which still 
applies by our expurgation procedure. For a uniformly dis- 
tributed random variable J taking values in the set {1, . . . , J n } 
we obtain with Lemma 2.7 of (Tl | (uniform continuity of the 
entropy function) 

Jn 1 

I(J;Z?) = Y, T {H(Vn~H{V- 3 )) 
j=i ™ 
= H(Z£) — H(Z"\J) 

< -10elog(10e) + 10nelog|C7| 

uniformly in t E 9 (for lOe < e _1 ). Hence the strong secrecy 
level of the definition I2.ll holds uniformly in t € 9. Using 
standard arguments (cf. [11] page 409) we then have shown 
the achievability of the secrecy rate 

R s = min max (I(V, Y t ) - I(V, ZA). (34) 
tee v-*x-*{Yz)t 

■ 

Remark. Note that in the case that 2U := {Wt,14 : t = 
l,...T,s = 1, . . . S} with S ^ T and the pair (s, t) known 
to the transmitter prior to transmission nothing new happens. 
A slight modification of the arguments presented above shows 
that 

Cs.csim = min max (I(V, Y t ) - I(V, Z s )). 

(t,s) V^X^(Y t Z s ) 

C. No CSI 

In the previous section we have assumed that the channel 
state is known to the transmitter. We now consider the case 
where neither the transmitter nor the receiver has knowledge 
of the channel state. We will prove that 
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Theorem 3.6: For the secrecy capacity Cs(W) of the com- 
pound wiretap channel 2B without CSI it holds that 

C s (23J) > max (min I(p, W t ) - max I(p,V t )). 

p£V{A) tee tee 

Proof: Caused by the lack of channel knowledge we use 
a stochastic encoder independent of the channel realisation. 
For any p £ V{A) let p' £ "P(A n ) be the distribution given 

by 



p'(x n ) 




if x n e r;> 

otherwise. 



Then analogously to the case with CSI we define 
Qt,^(z n ),Q t , x n(z n ), and Q' t {z n ),e t (z n ) for z n e C" but 
now with respect to the distribution p' . Consequently, &'(■) has 
support only on T™ Vt 2 u| { , and Qt )X «(-) and O(-) only on the 
set 5. Furthermore 0(z") > ea t for all z™ £ 5. Now define 
J n -L n i.i.d random variables X,-; according to the distribution 
p' independent of t £ 9 with j £ [J„] and / e [L„] with 

J _ |^2™[ mint 1 (P:Wt)-maXi / (P.Vt)— r]j 

L„ = L2" [roax * J(p ' Vt)+ T ] J (36) 

for r > 0. Now because 6 t (z n ) = EQ tyXjl > for all 
z n £ S we define the event tj(t) as in ( TOT l for the random 
variables /3 f r 1 Q t ^ X]l 

^•(*)= n (t-e^^") 6 [a±<oet (*")]), 

but considering the difference that the random variables Xji 
are independent of the channel state. Then analogously to (fTol l 
we obtain that 

Pr{M*)) c } < 2|Crexp(-L B ) 

by Lemma l3~4l and Lemma [3~2l Notice that, because the sender 
does not know which channel is used, we need the maximum 
in the definition of L n . Thus the right-hand side is a double 
exponential in n and can be made smaller than eJ^ 1 for all j 
and for all t £ 9 and sufficiently large n. 
Now let J„ and L n be defined as stated above, and let X n = 
{Xjl}je[J n ],l&L„] be the set of i.i.d. random variables each of 
them distributed according to p' independent of t € 9. As in 
the case of CSI we can show that reliable transmission of the 
message j £ [J n ] can be achieved. To this end define now the 
random decoder {Dj(X n )}j e [j n j C B n as in dT8l > but with 

D 'A xn )-=U U Tw.A x *)> 

see ke[L n ] 

and the random average probabilities of error for a specific 
channel \$(X n ) as in ( Tl9] >. Notice that now both X n and 
L n do not depend on t £ 9 and this holds throughout the 
entire proof. Then we can give the bound in d20l i now by 

wrdDjix^nxjo 



EEE 

3 ¥=] 



We can bound the first term in the inequality by v n (S) := (n + 
iyA\\B\ . 2 -nc5 (see (|2T3). If we average over all codebooks 
we get 

Ex™(W® n ((Dj(X n )) c \Xji)) < 

y yy ^^wr^ix^x^. 



EEE 



By the same reasoning as in (l22l > and d23l we can give an 
upper bound on 

E Xil Wr(T£ s , s (Xfk)\X 3l ) 



< 



< 



QfiVr.AXi'k)) 



( n + l)l^l|S| 



. 2 -n(I(p,Ws)-i(5)) 



1 - (n+ 1)1^1 • 2- ncS2 

for all t £ 9, all j' ^ j and all k, I £ [L n ] with a universal 
f(S) > satisfying lim^o f(S) — 0. qf n denotes the output 
distribution generated by the conditional distribution W® n and 
the input distribution p®". Additionally we define fj, n (5) := 
1 - (n + ■ 2- ncS \ Then (ED changes to 

Ex^wrmixnm^) 



,„ (n + l)l A H B l 
< v n {6) H — — T ■ J n L T . 



T ■ 2~ n ^ 



2~ n(r_ 



, I(p,W.)-f(S)) 



by the definition of J n and L„ and by choosing 5 > 
small enough that r — j — f(5) > ^. Now by defining 
a := mm ^ ' 2 1 an( j me definition of the error probability 
the last inequality results in the upper bound 

E X n(A$(X n )) <T-2- na 

for any t £ 9 and neN large enough. 

Now we define the event to(t) for any t £ 9 and the event 
l as in d25l l and (|27] | but with the difference that the input 
is independent of the channel realisation. So by the same 
reasoning we end in 

Pr{t c } < T 2 ■ 2- nc " 

for a constant c" > and all sufficiently large n £ N, which 
implies that there exist realisations {xji} of {Xji} such that 
Xji £ l for all j £ [J n ] and I £ [L n ], Then analogously to 
we get for any channel t £ 9 



1 



v t n (-\ Xjl )-e t (-) 



< 5e 



differs from the former only by L n in place of L n ^- Hence, 
following the same arguments subsequent to d29l >, we have 
shown that there is a sequence of (n, J n ) codes for which 

max max — V Wf n (D^ Xj i) < ■ 2^ 
tee ] L n ^— ' 

holds for sufficiently large n £ N, and the strong secrecy level 
is fulfilled for every channel t £ 9 by 



y tj 



V t n \\<Qe 
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(V t n j, V t n defined as in ([33)) and thus by 



I(J;Z?) < -lOelog(lOe) + 10nelog|C| 



which tends to zero for n oo uniformly in t E 9. ■ 
We turn now to the converse of Theorem 13.61 Actually, 

we give only a multiletter formula of the upper bound of the 

secrecy rates. First we need the following lemma. 

Lemma 3.7: Let 2XJ = {{W t ,V t ) : t E 9} be an arbitrary 

compound wiretap channel without CSI. Then 

J jnax _(inf I(U;Y t n ) - sup7({7; Z%)) 



lim 

n^oo n U->X™^Y f n Z? "te6 



let 



exists and we have 



lim — 



max (inf I(U; Y t n ) - sup7(*7; Z t ")) 
tee 



sup - max (inf I(U;Y t n ) - sup7(f7; Z?)). 

nCN n u^X'-^YfZ? tee te0 



Proof: The proof is based on Fekete's lemma fT3l . 
Consequently, if we apply the lemma to the sequence (a n ) n eN 
defined by 

a n := max (inf 7(f/;F t ") - sup I(U; z t)) 
u^x "->r t z t tee tee 

it suffices to show that the inequality 



holds for all n, m E N. This will be done by considering two 
independent Markov chains U\ — > X n — > (Y t n , Z") and U 2 -> 
X rn -> (Y t m ,Z^) and setting [7 := {Ux,U 2 ), X n+m := 
(X",X™), and (y ( "+ m ,Z t " +m ) := ((5?, (Z t ",Z t m )). 
Then by the definition of o„ 

a„ +m > inf I(U; Y t n+m ) - sup I(U; Z? +m ) 



let 



let 



> inf I(Ux ;Y t n ) + inf 7(C/ 2 ; Y t m ) 
tee tee 

- snp I (U i; Zl 1 )- sup I (U 2 ; ZD- 
tee tee 

By the independence of the two Markov chains mentioned 
above and because apart from that these Markov chains were 
arbitrary we can conclude that 

holds for all n, m E N. ■ 

Proposition 3.8: The secrecy capacity of the compound 
wiretap channel in the case of no CSI Cs(2B) is upper 
bounded by 

Cs(2U) < lim - max (inf I(U; Y t ") - supJW; Z?)). 

Proof: Let {C n ) n en be any sequence of (n, J„) codes 
such that with 

SU P7"E E =: ei,n, (37) 



lei 



and 



sup/(J;Z t ") =: £ 2 ,„ 
tee 



it holds that lim^oo e\, n = and lim^oo e 2 ,n = 0, where J 
denotes the random variable which is uniformly distributed on 
the message set {1, . . . , J n }. Let us denote by J the random 
variable with values in {1, . . . , J n } determined by the Markov 
chain J —> X n —> Y™ —> J where the first transition is 
governed by E, the second by W® n , and the last by the 
decoding rule. Then we have for any t E 9 



logJ„ = H{J) 

= I(J;J)+H(J\J) 
< I(J;Y t n ) + H(J\J), 



(38) 



where the inequality follows from the data processing inequal- 
ity. Then using Fano's inequality we find that 

77(J|J) < l + £i,„logJ„ 

with (f3Tb . Thus we can rewrite inequality ( f38l > as 

(1 -£!,„) log J n <7( J; + l 

for all t E 9. On the other hand we have for every t E 9 

7(J; Y t n ) = 7(J; Y t n ) - su P /(J; Z?) + e 2 . n 
tee 

where we have used the validity of the secrecy criterion stated 
above. Then the last two inequalities imply that for any t E 9 

(1 - ei,„) log J„ < 7(J; Y t n ) - sup 7(J; Zf) + e 2 . n . (39) 

tee 

Since the LHS of d39l does not depend on t we arrive at 

(l-ei,„) log J„ 

< max (inf7(C/;Y t ") - supI(U;Z?)) + s 2>n , 
u^x n -fY t z t tee tee 

which concludes the proof after dividing by n E N, taking 
lim sup and taking into account the assertion of Lemma 13.71 

■ 

Remark. Following the same arguments subsequent to (l34l ) 
concerning the use of the channels defined by Py t \T = Wt ■ 
Px\t an d Pz t \T — VfPx\T instead of Wt and V* and applying 
the assertion of Theorem l3.6l to the n-fold product of channels 
Wt and Vt, we can give the coding theorem for the multiletter 
case. The capacity of the compound wiretap channel in the 
case of no CSI is 

C S (W)= lim - max (inf7(C/ ; y t ")- S up7(t/;Z t ")). 

n-s-oo n u^x n ^Y t n z™ tee t eey 

Let us consider now the case 2U := {Wt, V s : t = 1, . . .T, s = 
1, . . . S} with S 7^ T and the pair (s,t) unknown to both 
the transmitter and the legitimate receiver. Additionally we 
assume that each V s is a degraded version of every Wt, which 
is characterised by 



V,(z\x) 



J2w t (y\x)D (ttS) (z\y), 
yeB 



(40) 



for all x E A, z E C, if D is defined as the stochastic matrix 
D : B — > ViC"). Then we have the following 

Lemma 3.9: Let p E V{A), W : A -> V(B), V : A -> 
V(C), and assume that V is a degraded version of W. Then 
I(X;Y\Z) is a concave with respect to the input distribution 
Px =P- 
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Proof: Let X, Y, Z be random variables with values in 
A, B, C respectively distributed according to 



(41) 



Pr(X = x,Y = y,Z = z) 

■ = Pxyz(x, y, z) = p(x)W(y\x)D(z\y) 

for all x G A, y E B, z E Z. Because 

I{X; Y\Z) = H(Y\Z) - H(Y\X, Z) 

the proof is based on the two assertions 

1) H{Y\Z) depends concavely on px, and 

2) H(Y\X, Z) is an affine function of px- 

First, H{Y\Z) is a concave function with respect to pyz by 
the log-sum inequality (cf. [11] Lemma 3.1). Then because 
Pxyz depends affmely on px by (HH . so does pyz, and the 
first assertion follows. For the second consider that (l40b and 
(|4TT i imply that 



Pr\x,z(y\x,z) 



W(y\x)D(z\y) 
V(z\x) 



for every input distribution px, any y E B and all x E A, z E 
C with pxz(x, z) > 0. Then we have 



H(Y\X,Z)= Pxz(x,z)H 



xeA.zec 



W(-\x)D(z\-) 
V(z\x) 



showing that H(Y\X, Z) is an affine function of pxz which 
in turn depends affmely on px- ■ 
Now because the random variables X, Y t ,Z s (Y t ,Z s the 
channel outputs of Wt and V s resp.) form a Markov chain 
for all t € 9 and s E S, we obtain that 



I(X;Y t \Z s ) = I(X,Y t ) - I(X,Z S 



(42) 



By virtue of Theorem 2 of lfl4l we can show that for the 
secrecy rate it holds that 

1 ™ 

Rs < -J2l(Xi;Yi,t\Zi, a )+t? 

n * — » 



for any channel (t, s) £ 9 X S and e' > 0. The concavity of 
I(X;Y t \Z s ) with respect to the input distributions p E V(A) 
together with d42l > then imply the converse part of Theorem 
I3~6l that 

R s < max min(7(p, W t ) - I(p, V s )). 

peV(A) (t,s) 

Now we can state the following 

Proposition 3.10: If V s is a degraded version of Wt for all 
s E S and t E 9 the capacity of the compound wiretap channel 
is given by 

C S (2U) = max mm(I( P) W t ) - I( P) V 3 )) 
P er(A) (t,s) 

= max (min I(p, Wt) — maxiYp, V s )). 

pev(A) t s 

Remark. This result was obtained in |[T) with a weaker notion 
of secrecy. 



D. Channel state to the legitimate receiver is known at the 
transmitter (CSIt) 

We now consider the case, in which the transmitter has 
knowledge of the channel state to the legitimate receiver 
t E 9 but the channel state to the eavesdropper s E S is 
unknown. Consequently we get for each t E 9 possible channel 
realisations 2U t := {(Wt,F s ) : s — 1, . . . S}. Then we can 
describe the compound channel as 2U = Utee%Bt- 

Theorem 3.11: For the secrecy capacity Cs,csi t {^) °f m e 
compound wiretap channel with CSI to the legitimate receiver 
it holds that 

Cs,CSh(%B) > min max (I(p, W t ) - m&xl(p, V s )). 
tee pev(A) s<£S 

Proof: Adapted to the channel realisation Wt define 



P' t {x n ) 



Pf"(s") 





if X" g T P l 5 , 
otherwise. 



(43) 



for arbitrary input distributions Pi,---,Pt G Now 
define for z n E C n and s E S 

Q s M^) = V:(z n \x n )-l nis{x ^(z n ) 

on C n . Additionally, we set for z n E C n 

e' s (z n )= Pt{x n )Q*Mz n )- 

Now let S := {z n E C n : @' s (z n ) > ea t , s } where e = 
2~ nc s ~ and a t , s is from ([8]) similar to the former cases but 
computed with respect to p t and V s . Then the support of Q' s 
has cardinality < a^l, which implies that ^2 z n eS Q s (z n ) > 
1 — 2e. Analogously to (fT2l) define 9 s (z n ) and Q s , x ™{z n ) with 
support on S and further 

J n = |^2 n [ mint ( / ( pt ' W ' t )~ maXs 7 (pt' y s))~ r lj (44) 
L n>t = \2 n[m ^ I(pt - v ° )+ i ] \. (45) 

As in the case of CSI define random matrices 



such that the random variables X 



(*) 



where i.i.d. according to p' t . We suppose additionally that 
{Xji an d {Xjl are independent for t ^ t'. For any 
z n E S it follows that Q s {z n ) = EQ (t) (z 11 ) > ea t , s , if E 

is the expectation value with respect to the distribution p t . 
For the random variables /3^lQ g x ( t ) (z n ) define the event 



Lj(s,t) 



»€C" [ n ' t 1=1 11 J 

Then it follows that for all j E [J n ] and for all s E S it holds 
for each t E 9 

Pr{(^(s, t)) c } < 2\C\ n exp ( - L n , t J 

by Lemma 13.41 Lemma 13.21 Thus the RHS is double ex- 
ponential in n uniformly in s E S,t E 9 (guaranteed by 
the maximum in s in the definition of L n t) and can be 
made smaller than eJ" 1 for all j E [J n ] and all sufficiently 
large n. Now the coding part of the problem is similar to 
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the case with CSI. Let p' t € V{A n ) be given as in d43l >. 
We abbreviate X :— {X^'} t ^e for the family of random 
matrices — {X^ }je[J„],le[L n t ] whose components are 
i.i.d. according to p' t . We will show how reliable transmission 
of the message j E [J n ] can be achieved. To this end define 
now the random decoder {Dj(X)}j e \j n ] Q B n as in < TT~8T > and 
with 

^(*) : =U U Tw„8{ x ?h 

r£6 ke[L n , r ] 

and the random average probabilities of error for a specific 
channel \ { n ] (X) as in <|T9) by 

:=T Er E Wf n {{D ] (X)) c \ xff) . 
Jn je[Jn] le[z„.«] 
As in < f20b we get for each t E 9 and I € [i n ,t] 

Wf"((Z?,-(A')) c |Jfg ) ) 



< 



E E 

i'G[J„] r-G9fce[L n , r ] 



E ^ n (^,«(4fc)i4 : )- 



Then by Lemma 13.11 we can bound the first term of the right 
hand side, such that together with the independence of all 
involved random variables we end up with 



E x (wr((D 3 (x)y\x^)) 

< (n + 1) 



A\\B\ 



-nc5 



E E 



E 



j'e[J n ] ree ke[L n , r ] 



(46) 



We shall find now for j' ^ j by the same reasoning as in 
and ( 1231 an upper bound on 



E x vwr(i% r 4 x fl)\ x ?i J ) 



i? n (Tw r A x rl)) 
pf n (Vis) 

( n+1 )|A||fl| 



< 



< 



. 2 -n(I(Pr,W r )-f(S)) 



, (n + • 2- ncS2 

for all r,t € 6, all j' ^ j, and all I E [L nt ],k E [£ n ,r]- 
Now by defining v n (S) := ( n +l)I^H B l-2-" c ^ and //„(£) := 
1 - (n + • 2^ nc<52 thus for each t E 9, I E [L„ jt ], and 
j € [J n ] d46l l and the last inequality leads to 

E X (wr((DAx)r\x^)) 



< u n (S) + 

< MS) 



(n + 1) 



Mn(<5) 



Mn(<5) 



-TJn 



t r 9 -n(/(p r , 



-n(min re() (/(p r ,W r )- 



./(pr,V.))-/(«)-f) 



where we have used the definitions of J n and L n r and we 
have chosen 5 > small enough to ensure that t — f{5) — 



we can find 



5 > f. Defining a = a(6,r) := ™*f>H 
n(S,T, \A\, \B\) E N such that for all n > n{S,r, \A\, \B\) we 
end in 

E X (\%\X)) <T-2- na . 

for any t E 9. To give a bound on the average probability of 
error we define the event io(t) for any t E 6 as in d2~5l l and 
the event 

t: ^nn rw*>«) 

tes ses fc=o 

differs from (l27l > only by the intersection of the unknown 
channel states s E S. Thus we can conclude that 

Pr{t c } < S -T ■ e + S -Ti -2- n ^ 
< S • T 2 • 2- nc " 

holds for a suitable positive constant c" > and all sufficiently 
large n E N, and we have shown that for each t E 9 there exist 
realisations {(x^ )je[j n ],ie[L„ t ] ■ t E 9} E l of X. By the 



same reasoning as in (1281 1 we get for any channel realisation 
t E 9 to the legitimate receiver 



1 



eV(-i*S? 



v s n (-\xf ) -e.(-) 



< 5e 



for each of the unknown channels s £ 5 to the eavesdropper. 
Now, because for any t E 9 we have a different codeword set 
{x^}, we slightly change the definition in PTT) to 



%,t)(^IO'>0):=K n (^Ki J ) 



(*h 



and accordingly to V/" t ^ ^ and V"/™ t % in ( 1321 ). ( T33l > in that 
way, that these distributions are defined separately for each 
codeword set t E 9. Thus we get, that 



VT 



< lOe 



'(s,t),j y (s,t)\ 

is fulfilled for all s E S for each individual channel t E 9 to 
the legitimate receiver. 

Hence, using the same expurgation scheme as in the previous 
sections we have shown that there is a sequence of (n, J n ) 
codes for which 

1 



max max 



E 



holds for sufficiently large n EN, and the strong secrecy level 
is fulfilled for every channel t E 9 by 

I(J; Z n s ) < -lOe log(lOe) + lOne log |C| 

which tends to zero for n — > oo for all channels s e 5 to the 
eavesdropper. Thus we have shown that 

Rs = min max (/(», Wt) — max I(p,V s )) 

is an achievable secrecy rate for the compound wiretap channel 
Utee^Ot in the case where the channel state to the legitimate 
receiver is known at the transmitter. ■ 
Remark. By considering the converse of Theorem |3.1 U we get 
for each t E 9 possible channel realisations 2U t := {(Wt, V s ) : 
s = 1, ... S}. Then we can describe the compound channel as 
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2U = Utee^Ot- In accordance to the case of no CSI for each 
t E 9 we obtain that 

C s (W t )= Km - max (I(U ; Y™) — sup I(U ; Z™)). 

n->oc ft l7-yX n ->-Y t B .Zy sg 5 

Proposition 3.12: The secrecy capacity of the compound 
wiretap channel in the case where only the channel state to 
the legitimate receiver is known at the transmitter Cs,csi t (2D) 
is given by 

C s ,csi t (W) =mfC s (2Bi). 

Now, additionally let us assume that each V s is a degraded 
version of every Wt for s E S and t E 9. Then as shown 
in lemma [3]9]/(X; Y t \Z s ) is a concave function with respect 
to the input distribution px = p. In particular this still holds 
for min se s I(X; Y t \Z s ). Now because the random variables 
X, Y t , Z s form a Markov chain for all t E 9 and s E S and 

min I(X;Y t \Z s ) =I(X,Y t ) - max I(X, Z s ) , 

for any t E 9 we get the upper bound on the secrecy rate as 
the secrecy capacity of a single channel Wt with S channels 
to the eavesdropper. Then we can conclude 

Proposition 3.13: The secrecy capacity of the channel 
where only the channel states to the legitimate receiver are 
known and the channels to the eavesdropper are degraded 
versions of those to the legitimate receiver is given by 

Cs,csi t (2D) = min max (J(p, W t ) - maxl(p, V s )). 
tee pev(A) ses 



E. A compound wiretap channel with Cs — Cs,csi 

Let 2B := {W t ,V s : t = 1, . . .T, s = 1, . . . S} with S ^ T 
and the pair (t,s) unknown to both the transmitter and the 
legitimate receiver. In addition let us assume that 



3t E 9 Vt E 9 3U t : Wt = U t W u 



(47) 



which means that Wt is a degraded version of all channel Wt 
with t ^ t. We further assume that 



3sESVsES3U s : V. = U.Vg. 



(48) 



which means that all V s with s ^ s are degraded versions of 
Vs. Then we can show that the capacity of this channel equals 
the capacity of the same channel with CSI at the transmitter, 
e.g. 

C s (2U) = C St csi$B). 



First, by Theorem 13.61 it holds that 

C S (W) > max xmn(I(p,Wt) - I(p,V s )). (49) 

p£V(A) (t,s) 

Now let 

p* = arg max (I(p, W { ) - I(p, Vg) 
pev(A) 

the input distribution that achieves capacity for the single wire- 
tap channel (Wf, Vg). Because the capacity of the compound 




Fig. 1. Compound wiretap channel SIT = {(Wt, Vt) : t = 0, 1} of Ex. 1 



wiretap channel 2U is less than or equal the capacity of each 
single channel we obtain 

C s ,csi(W) < I(p*,W { )-I(p*,Vg) = C s (W h Vs) 

< I(p*,U t W t )-I(p*,U s V s ) 

< I(p*,W t )~I( P *,V s ) (50) 

for all (s,t) E S X 9 because of (07]l, (gHJl. Then by the last 
inequality it follows that 

I(p* ,W t ) - I{p*,Vg) = mm(I(p*,W t )-I(p*,V a )) 

(«.*) 

< max mm(I(p,W t ) — I(p,V s j) 

pev(A) (s,t) 

Now taking into account d49l and ( T50b we end in 

C s ,csim < C S {W) 

and therewith for this channel the lower bound of the capacity 
without CSI matches the capacity of the compound wiretap 
channel with CSI. 

IV. Examples 

In this section we provide some examples which display 
some striking features of compound wiretap channels as 
opposed to the usual compound channels. Our first example 
shows clearly that for compound wiretap channels with CSI at 
the transmitter the strategy of sending both the message and 
the randomisation parameter does not work. The second one 
demonstrates that even in the case where the sets of channels to 
the legitimate receiver and the eavesdropper both are convex, 
we can have 

CV?s/(2H) > and C7 S (2U) = 0, 

as opposed to the case of the usual compound channel where 
the Minimax-Theorem applies. 

In the following we use some simple facts which we state 
here without proof. 
Fact 1. The binary entropy function 

h(x) := — xloga; — (1 — x) log(l — x), x E [0, 1], 

is strictly increasing on [0, a]. 
Fact 2. Let r] E [0,1] and set 



D„ := 



1-ry 
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Then for every r, r' £ [0, 1] it follows that 

D T D T i = D t+t i-2tt' ■ 

Moreover, if r, t' G (0, |) then 



1 



t + t' -2rr e (0, -) 



and 



r + r' — 2tt' > r, r'. 
Fflcf 3. For t, i G [0, 1] 

(l-t)D +tD T = D tT . 

A. Example 1 

Consider a compound wiretap channel 2H = {(Wt,Vt) : 
t = 0, 1} in the case of CSI at the transmitter. First we define 
the channels to the legitimate receiver and to the eavesdropper 
for t = by 

Wo =D V , rj£ [0,~), 77 «0, 

V :=D T W Q , r£ [0,1), r « 0, 
and for t = 1, f G (0, 1/2] 
Wi :=£> f Vb = DflWo, 
Vi := ft 

Hence Vo and Wi are degraded versions of Wo an d 

I( P ,V 1 )=0, VpeV(A) 

by definition of V\. Now for every p <E V(A) we can choose 
r small enough, that 

J(p, Wo) -I(p, Vo)</(p,Wi). 



Po= ? 



Now with 



> and because we have CSI at the transmitter we have by 
the defining equations (TT~3T > and ( TT4b 

r „ — o"[^(po,Vo)+f ] 
such that we obtain 

J T - - 9 n[I(p ,W )-^] 

But for t close to 1/2 it holds then that 

I(po,W )- y>/(po,Wi) 

= max J(p,W 1 ) = Ccsj{W 0! Wi}, 

where Ccg/jWo, Wi.} is the capacity of a compound channel 
with CSI at the transmitter. Hence we have shown, that we 
can achieve reliable transmission of the message j £ [J n ], but 
identifying both the message and the randomizing indices is 
not possible for all pairs j £ [J n ] and I £ [L n t \. This is in 
contrast to the case where we have only one channel to both 
the legitimate receiver and the eavesdropper (cf. Q, J4)). 




Wi D r Vi 

Fig. 2. Compound wiretap channel W := {(Wt,V t ) : t 6 [0, 1]} of Ex. 2 

B. Example 2 

Now, for T), t £ (0, |) we set 

W = Ay, Vo := D T Wo = D v+t _2 V t 

and 

W := D T F = D 2t _ 2t 2W , Vi := D T W X . 

Notice that Vo is a degraded version of Wo, W\ of Vo, and 
Vi of Wi. Next we define for t £ [0, 1] 



W t :=(1 - i)Wo + iWi 

= [(l-t)I>0+tI>2r-r»]Wb 



(51) 



and 



v t -Mi-tWo + w 

=D T [(l-t)D Q +tD 2T _ 2T 2]Wa (52) 
=D r W t 

By the definition, the set of channels to the legitimate receiver 
{Wt} and the set of channels to the eavesdropper {Vt} both are 
convex. Nevertheless we will show now, that for the compound 
wiretap channel 2U := {(W t , Vt) : t £ [0,1]} we have 

C s ,csim > 0, C S {W) = 0. 
To this end, note that by ( BTT i. fact 3, and fact 2 we have 

W t = A(2r-r 2 ) D v = Df( t ,r),T) 

with 

/(t,r?,r) := V + t(2T-2T 2 )-2 V t(2r-2T 2 ) £ (0,1). (53) 
Similarly from ( T52l and fact 2 we obtain 

V t =D T D f(t,n,r) 

= D T + f(,t,T h T)-2Tf(t,T l ,T) 

Additionally from (1531 and fact 2 we get 



T + f(t,r),T)-2Tf(t,r],T) £ (0,-) 



and 



r + /(*, 77, r) - 2r/(t, r?, r) > f(t, r,, r). (54) 
Taking p = (1/2, 1/2) we obtain for every t £ [0, 1] 

I(p,Wt)-I(p,V t ) 

= h(r + f(t, 77, r) - 2r/(t, 77, r)) - fe(/(t, rj, r)) > 
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where the last inequality follows from fact 1 and d54l i. Thus 
we have shown that 

C s ,csim > 

holds by Theorem 13.51 

In order to show that Cs (20) = 0, we have to employ our 
multiletter converse in the case of no CSI, Proposition 13.81 
First, a simple algebra shows that for any t £ [0, 1] 

V t = ((l-i)A) + tD 2T _ 2T 2)Vb 

by ( |52l and thus each V t is a degraded version of Vo- Then 
the data processing inequality implies that for each neN 

m^I( P) V® n ) = I(p,V® n ) (55) 
for all p e V({0, 1}™). 

On the other hand, since W\ = D t Vq we obtain by data 
processing inequality and (IB3T l for all n 6 N 

Hp, W® ") - max Hp, V® n ) = I(p, W? n ) - I(p, V® n ) < 0, 
for all p e V({0, l} n ). Then Proposition l3~8l implies that 

Csm = o 

as desired. 
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